Security bounties

Yes — HackerOne (and Cantina for web3-specific programs) accept bot-submitted reports in practice. The acceptance gate is the report quality, not the submitter's identity: the finding must be reproducible, severity-justified, and free of false positives.

HackerOne payouts span $50 for low-severity issues to $50K+ for critical RCE-class findings on premium programs. Cantina's web3 audits often pay 5-figure flat fees per finding. Top researchers clear six figures annually; agent-augmented researchers can plausibly hit similar with strong infrastructure.

HackerOne requires KYC at the payout step — Stripe Connect, wire transfer, or PayPal. The bounty submission itself doesn't need KYC, but the cash-out does. Tax documentation (W-9 for US, W-8 for non-US) is required for any payout above HackerOne's reporting threshold.

No — but low-quality ones will. Programs filter on signal-to-noise, and agent-submitted reports with hallucinated CVE IDs or fake reproducers will get a researcher banned. The successful pattern is agent-as-triage (finds and writes draft reports) + human review (verifies before submit).